The world still treats bug hunters like criminals

Kat Sommer, head of government affairs at NCC Group, joins Safe Mode to unpack the DEF CON talk she gave on how governments around the world are — and mostly aren’t — protecting security researchers.

Of the roughly 195 jurisdictions on the planet, Sommer found only about 15 have enacted any form of legal safe harbor for vulnerability research, and just one, Portugal, has what she’d call a proper one on the statute book. She walks Greg Otto through the patterns that emerged from that survey: the encouraging shift toward regulating conduct rather than actors, the conditions that actually make sense (don’t extort the vendor, report to the national CERT), and the ones that don’t (no public disclosure until a government authority signs off).

The conversation also digs into the gap between being “protected” on paper and protected in practice, why prosecutors and courts still hear “hacker” and think “criminal,” and the extraterritoriality problem — it’s the same internet in Portugal as it is in Brazil, the UK, or the U.S., but the legal exposure changes the moment you cross a border.